Quantitative evaluation.
tab:rescv gives quantitative comparisons for IG, GI-GIP, and LTI against various defense mechanisms on CIFAR10. When no defense is applied, GI-GIP achieves the best performance according to all three metrics, whereas LTI performs almost equally well in terms of MSE and close to that of IG in terms of PSNR and LPIPS. However, when the gradient is augmented with a defense mechanism, both IG and GI-GIP have considerably worse performance with MSE close to \(0.1\) . By comparison, LTI outperforms both baselines significantly and consistently across all three defense mechanisms.
For example, under gradient perturbation with \(\sigma =0.1\) , which prior work believed is sufficient for preventing gradient inversion attacks [1]}, [2]}, MSE can be as low as \(0.012\)  for LTI. Our result therefore provides considerable additional insight for the level of empirical privacy achieved by DP-SGD [3]}, and suggests that the theoretical privacy leakage as predicted by DP \(\epsilon \)  may be tighter than previously thought.
